Details

Restrict kubelet nodes to reading only objects associated with them.

Rationale:

The ‘Node’ authorization mode only allows kubelets to read ‘Secret’, ‘ConfigMap’, ‘PersistentVolume’, and ‘PersistentVolumeClaim’ objects associated with their nodes.

Solution

Edit the API server pod specification file ‘/etc/kubernetes/manifests/kube-apiserver.yaml’ on the master node and set the ‘–authorization-mode’ parameter to a value that includes ‘Node’.

–authorization-mode=Node,RBAC

Impact:

None

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1788

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-6
• CSCv6|9.1

Source

• Tenable.com/audits